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April 5, 2019 

The Honorable Ron Wyden 
United States Senator 
221 Dirksen Senate Office Building 
Washington, DC 20510 

Dear Senator Wyden: 

I am responding to your March 13, 2019 letter to AT&T Chairman and CEO Randall 
Stephenson requesting information regarding AT&T’s disclosure of customer location data. 
Previously, you asked about AT&T’s location-based services and our use of aggregators to 
support those services, and we stand by our prior responses on those subjects. As noted in our 
prior response, despite the numerous benefits to consumers of location-based services, we 
decided to cease providing location i n formation to all aggregators, and we have now completed 
that shut down. 

Your latest letter now asks about instances in which individuals have impersonated law 
enforcement officers in an attempt to receive customer location data through fraudulent 
representations of exigent circumstances. As do all communications companies, AT&T 
provides location data to law enforcement in certain emergency circumstances where there is a 
risk of death or serious physical injury, as permitted by federal law. 1 Disclosure in these 
circumstances is not only lawful, but it is unquestionably the right thing to do. These services 
save lives. To protect citizens in states across the country, including Oregon, communications 
carriers have worked with law enforcement to locate missing persons, victims of assault, and 
stranded hikers. 2 AT&T is proud of this work. When lives are in danger, we are fast and 
accurate in helping locate those in imminent harm. 

While protecting individuals from harm is our first concern, we also have put in place 
hardened safeguards designed to ensure that a law enforcement request under exigent 
circumstances is made by an authorized law enforcement representative working within the 
scope of his or her duties. AT&T reviews each request to determine it is valid and obtains a 
certification from the relevant law enforcement agency confirming that the request calls for 
information relating to a case of potential death or serious injury, but we are careful not to 


1 See, e.g., 18 U.S.C. § 2702(b)(8). 

2 See, e.g, James Rogers, How Tech Tracks Missing People, FOX NEWS (Aug. 2, 2014), 

https://www.foxnews.com/tech/how-tech-tracks-missing-people: Aaron Brilbeck, Family Says Cellphone Ping Led 
to Location of Missing 14-Year-Old In Duncan, NEWS 9 OKLAHOMA CITY (Dec. 28, 2018), 

httPs://mvfox8.com/2013/12/10/missing-group-of-2-adults-4-children-found-in-nevadas-bitter-cold/#thumbnail- 
modal : Mike Morris, Missing Georgia Tech Student Found Alive, but Bruised, THE ATLANTA JOURNAL- 
CONSTITUTION (Oct. 19, 2015), https://www.aic.com/news/local/missing-georgia-tech-student-found-alive-but- 
hruised/lFX41AKZb8aKvRC9iSUEFL/. 
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publicly disclose more internal processes beyond this, because we do not want to give criminal 
actors a blueprint for our fraud and detection tools. 

Your letter refers to an incident described in a March 6, 2019, Motherboard article that 
cites anonymous sources and recounts the criminal activities of one individual who 
impersonated a U.S. Marshal in 2014 in an attempt to receive customer location information. 
The U.S. Department of Justice prosecuted this individual, who was sentenced to a term of 
imprisonment for his criminal activities. That incident did not involve AT&T, nor did the 
article discuss any other incident involving an AT&T customer. 

Sincerely, 





